Full Report
Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise
Analysis Summary
# Research: The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities
## Metadata
- **Authors:** Wiz Threat Research Team
- **Institution:** Wiz, Inc.
- **Publication:** Wiz Research Blog / Technical Report
- **Date:** August 26, 2026
## Abstract
The "State of Cloud Risk 2026" report analyzes why the majority of high-severity security findings do not lead to actual environment compromise. As cloud attack surfaces expand and the window between vulnerability disclosure and exploitation shrinks (now averaging 21.5 days), defenders are overwhelmed by alert volume. The research demonstrates that by applying "environmental context"—filtering for external reachability, toxic permissions, and sensitive data access—organizations can eliminate over 50% of high-severity alerts that represent no viable attack path, allowing for more surgical remediation.
## Research Objective
The research addresses the growing crisis of **defender fatigue** caused by high-volume, low-context alerts. It seeks to answer:
1. Why do most high-severity vulnerabilities fail to provide a path to compromise?
2. How has the timeline for adversary weaponization evolved?
3. Which specific cloud configurations represent the highest concentration of real-world risk?
## Methodology
### Approach
Wiz Research utilized a data-driven telemetry analysis to evaluate security findings across global enterprise cloud environments. They compared "raw" high-priority alerts against a filtered set that met "critical risk criteria" (intersection of vulnerability, reachability, and privilege).
### Dataset/Environment
The study analyzed telemetry from real-world enterprise cloud footprints, encompassing thousands of software products and cloud services across major providers.
### Tools & Technologies
- **Wiz Research Telemetry:** Proprietary cloud security graph data.
- **ZeroDayClock:** Used to track and average the time between CVE disclosure and in-the-wild exploitation.
## Key Findings
### Primary Results
1. **Context as a Noise Filter:** Applying environmental context (reachability and permissions) eliminated more than **50%** of high-priority findings across all categories.
2. **Accelerated Weaponization:** The window to patch has collapsed from two years to just **21.5 days**.
3. **The Reachability Predominance:** **30%** of cloud environments have externally exposed machines tied to high-impact lateral movement paths, whereas software RCEs only accounted for **9%** of observed critical findings.
4. **Risk Concentration:** Risk is not evenly distributed; a small cluster of specific technologies and weaponized exploits account for the vast majority of enterprise danger.
### Supporting Evidence
- **Lateral Movement:** Telemetry shows that the presence of high-privilege IAM roles adjacent to exposed assets is a significantly higher indicator of compromise potential than a high CVSS score alone.
### Novel Contributions
- **Shift from Vulnerability to Path:** Moves the focus from isolated CVEs to the "Toxic Intersection"—the point where a flaw meets the permissions and network access required to exploit it.
- **Quantifying the "Response Gap":** Providing updated metrics on the 21.5-day exploitation window serves as a new benchmark for SLA requirements in 2026.
## Technical Details
The research emphasizes the **Cloud Security Graph** concept. An isolated vulnerability (e.g., a critical CVE in a library) is technically "high severity," but if that library is on a non-exposed, low-privilege microservice with no access to secrets or sensitive databases, the "path to compromise" is zero. The "Toxic Combination" specifically looks for:
* **External Reachability:** Direct or indirect internet access.
* **High Privilege:** IAM roles with `AdministratorAccess` or powerful "cross-account" permissions.
* **Data Impact:** Proximity to sensitive assets (S3 buckets, RDS instances).
## Practical Implications
### For Security Practitioners
- Stop treating CVSS scores as the primary driver for remediation.
- Prioritize "unreachable" vulnerabilities lower than "reachable" medium-severity flaws that possess lateral movement paths.
### For Defenders
- **Focus on the 30%:** Address the externally exposed machines that lead to lateral movement immediately, as these are more likely targets than theoretical software exploits.
- **Shrink the Window:** Aim for a remediation cycle faster than the 21-day weaponization average for exposed assets.
### For Researchers
- Investigate the automated reconnaissance techniques used by attackers to map cloud IAM permissions post-entry.
## Limitations
- The report is based on Wiz’s specific telemetry and customer base, which may skew toward larger enterprises.
- The 21.5-day average for weaponization includes "high-profile" vulnerabilities; "long-tail" or niche software may have different exploitation timelines.
## Comparison to Prior Work
Traditional vulnerability management relied heavily on **CVSS (Common Vulnerability Scoring System)**. This research builds upon the industry shift toward **EPSS (Exploit Prediction Scoring System)** and **RBVM (Risk-Based Vulnerability Management)** by adding "Environmental Context" as the final, most critical layer of prioritization.
## Real-world Applications
- **SLA Adjustments:** Companies can relax SLAs for non-reachable vulnerabilities to prevent developer burnout.
- **Infrastructure as Code (IaC):** Use these findings to block "toxic combinations" (e.g., internet-facing + high-privilege role) at the pull-request stage.
## Future Work
- Analysis of how AI-driven exploitation might further shrink the 21.5-day weaponization window.
- Deeper study into the specific "core cluster" of technologies that account for the majority of risk.
## References
- Wiz Research: *The State of Cloud Security Risk 2026*
- ZeroDayClock: hxxps[://]zerodayclock[.]com/
- Related: *Rust Supply Chain Attack on arrayref* (Wiz Research, Aug 2026)